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Amendments to the Claims : 
This listing of claims replaces all prior versions and listings of claims in the application: 

Listina of Claims : 

1 . (Previously Presented) A rhethod of identifying unwanted messages, the method 
comprising: 

inspecting a payload portion of art electronic maiil message being communicated and 
identifying characteristics of the payload portion, the electronic mail message including an 
address of a recipient; 

comparing the characteristics of the inspected payload portion of the electronic mail 
message with stored data indicating characteristics of at least one other electronic mail message 
that has been inspected; 

based on comparison results, identifying a first security condition for the electrotiic mail 
message from among at least one of acceptable, unacceptable, and indeterminate states; and 
processing the electronic mail message based on the first security condition, wherein 
processing the electronic mail message includes: 

rejecting the qlectronic mail message if the first security condition associated with 
the electronic mail message reflects the unacceptable state; 

accepting the electronic mail message if the first security condition associated 
with the electronic mail message reflects the acceptable state; and 

if the first security condition associated with the electronic mail message reflects 
the indeterminate state, monitoring the electronic mail message by: 

transmitting the electronic mail message based on the address of the 
electronic mdil message; 

tracking a location of the transmitted electronic mail message; 
inspecting at least one other electronic mail message subsequent to 
transmitting the electronic mail message;. 
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updating the stored data to indieatc characteristics of the at least one other 
electronic mail message that has been inspected; 

rccategorizing the first security condi tion of the transmitted electronic 
rnail mesisa^ge to a second security condition of the transmitted electronic mail 
message based on the-updated stored data; and 

reprocessing the transmitted electronic mail message based on the second 
security condition, wherein: reprocessing the transmitted electronic mail riiessage 
includes deleting the transmitted electronic mail message if the second security 
condition reflects the unacceptable state. 

2. (Original) The method of claim 1 wherein the characteristics of the payload 
portion include information other than address information. 

3. (Original) The method of claim 2 w^icrein the characteristics of the payload 
portion do not include address information. 

4-5. (Cancelled). 

6, (Previously Presented) The method of claim I wherein a securi ty condition 
associated with an electronic mail message is identified as reflecting the unacceptable state when 
the comparison of the characteristics reveals a threshold number of messages having a shared 
characteristic. 

7. (Previously Breseiited) The method of claim ^ wherein reprocessing the 
transmitted electronic mail message based on the second security condition includes deleting the 
transmitted electronic mail message if the security condition associated with the at least one 
other electronic mail message inspected subsequent to the transmitting the electronic mail 
message is identified as reflecting the unacceptable state and the at least one other electronic 
mail message has characteristiGS in common with the transmitted electronic mail message. 
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8. (Previously Preiscnted) The method of claim 1 further comprising tracking the 
characteristics of the payload portion for comparison against characteristics of future electronic 
mail messages, wherein the characteristics of a new electronic. mail message are compared with 
the characteristics of at least one electronic mail message that has been tracked, 

9. (Previously Presented) The method of claim 8 wherein comparing the 
characteristics of the payload portion includes comparing the characteristics of the payload 
portion of electronic mail messages inspected with stored; qharacteri sties of other communicated 
electronic mail messages. 

1 0. (Previously Presented) The method of claim 8 wherein the characteristics of the 
payload portion of the electronic mail message are tracked when the first security condition is 
identified as reflecting the indetenminate' state. 

1 1 . (Previously Presented) The niefliod of claim 1 0 wherein an indeterminate state is 
identified if the comparison of the characteristics does not itjsclf reveal an unacceptable state, but 
the characteristics of the payload portion would reveal the unacceptable state in combination 
with similar characteristics of other electronic mail messages. 

12. (Previously Presented) The method of claim 10 further comprising accepting the 
transmitted electronic mail message if the second security condition associated with the 
transmitted electronic mail message reflects the acceptable state. 

13. (Cancelled). 

14. (Previously Presented) The method of claim 1 wherein identifying the first 
security condition includes comparing the characteristics of more than one electronic mail 
message received by a single device. 
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15. (Previously Presented) The method of claim 1 wherein identifying the first 
security conditioh includes comparing the characteristics of more than one electronic mail 
message sent by a single dcyice. 

16-29. (eancelled). 

30. (Previously Present^) The method of claim 1 wherein fecategorizing the first 
security condition of the transmitted electronic mgil message to a second security condition of 
the transmitted electrpnic mail message includes:reeategorizing the first security condition of the 
transmitted electronic mail message to a second security condition that reflects the acceptable 
state. 

3 1 . (Previ ously Presented) The method of claim 1 wherein recategorizing the first 
security condition of the transmitted electronic mail message to a second security condition of 
the transmitted electronic mail message includes reeategorizing the first security condition of the 
transmitted electronic mail message to a second seciirity conditioTi that reflects the unacceptable 
state. 

32. (Previously Presented) The method of claim I wherein identifying the first 
security condition as reflecting ,tlie acceptable state includes: identifying the first security 
condition as reflecting a neutral state. 

33. (Previously Presented) The mefliod of claim 1 wherein identifying, the first 
security condition as reflecting the unacceptable ^tate iriclude^^ the first security 
condition as reflecting a hostile state. 

34. (Previously Presented) The method of claim 1 wherein recategorizing the first 
security condition of the transmitted electrpnic mail message is performed when the stored data 
is updated such that the security condition asisociated with an electronic mail message with 
certain characteristics would be identified as reflecting a state other than the indeterminate state 
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and the security condition asisociaicd with an clcctTQnic mail message with thie same 
characteristics would have been identified as reflecting the indeterminate state prior to the 
update. 

35. (Previously Presented) The method of claim 1 wherein recategorizing the first 
security condition of the transmitted electronic-mail message is perforaicd if at least one other 
electronic maiJ message inspected subsequent to transmitting the electroiiic mail message 
includes a characteristic that increases the number of electronic mail messages inspected with 
that characteristic above a threshold level. 

36-37. (Cancelled). 

38. (Previously Presented) The method of claim 1 wherein recategorizing the first 
security condition of the transmitted electronic mail message is performed when an administrator 
updates the stored data to indicate that at least one Characteristic of an electronic mail message is 
acceptable. 

39. (Previously Presented) The method of claim 1 wherein recategorizing the first 
security condition of the transmitted electronic mail rnessage is performed when an administrator 
updates the stored data to indicate that at least one characteristic of an electronic mail message is 
unacceptable. 

40. (Previously Presented) The method of claim 1 wherein reprocessing the 
transmitted electronic mail message includes removing the transmitted electronic mail message 
from storage if the second security condition reflects the unacceptable state, 

41 . (Previously Presented) The method of ekim 1 wherein reprocessing the 
transmitted electronic mail message includes generating an alarm if the second security condition 
reflects the unacceptable state. 
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42. (Previously Presented) The method bf^claim 1 whereiti reprocessing the 
transmitted electronic mail message mcludes continuing to track the location of the transmitted 
electronic mail: message if the.second security condition still reflects the indetenninate statC; 

43 . (Previously Presented) The method of claim 1 wherein, recategoriizing the first 
security condition of the transmitted electrpnie mail message iriqludes: 

accessing the location of tK6, elcctrbnic mail message; 
retrieving the electronic mml message from the location; 

inspecting the payload portioii of the transriiitled electronic mail message and identifying 
characteristics of the payload portion; 

comparing the characteristics of the paylpad pprtion of the transmitted electronic mail 
message with the updated stored data; and 

in response to cbmparing,,i4entif^^^ the second security condition from among at least 
one of the acceptable, unacceptable, and indeterminate states. 

44. ( Withdravm) A method of determining a definitive classification of a first 
message, the method comprising: 

comparing at least one characteristic of the first message being comrriunicated with a set 
of niles used in determining classi fication of messages; 

in response to comparing, deteniiining whether the first message is associated with a 
definitive classificatiori; 

tracking the first message as a tracked message i f the first message is not associated with 
a definitive classification; and 

subsequently attemptin| to detennine the defiriitive the tracked message 

if the set of rules ^has been updated.. 

45. (Withdrawn) The method of claim 44 further comprising: 

continuing to track the first message as a tracked message if determining whetber the first 
message is associated with the definitive cliassifiGatidh for the tracked message fails to indicate a 
definitive classification for the tracked message. 
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46. (Withdrawn) The method of claim 44 further comprising: 

processing the first message based on the;classifrcation of the first message if the first 
message is determined to be asisociated with the defmitive:classification. 

47. (Withdrawn) The method of daim 44 wherein the first message is determined to 
be aissociated withthe.defihitive Glassificalidn if a security condifion associated with the first 
mess£^ge is associated with an acceptable state. 

48 . (Withdrawn) The method of claim 44 wherein the first message is determined to 
be associated with the definitive elassification if a security condition with the first 
message is associated with an unacceptable state. 

49. (Withdrawn) The method of claim 44 wherein the first message is determined to 
be associated with the disfinitive classification if 2i security condition associated with the first 
message is associated with a neutral state. 

50. (Withdrawn) The method of claim 44 wherein the first message is determined to 
be associated with the definitive claSsifiGation if a security coridifioii associated with the message 
is associated wiUi a hostile state. 

5 1 . (Withdrawn) The method of claim 44 wherein the first message is not 
determined to be associated with the definitive classification if a security condition associated 
with the first message is associated vyith aii indeterminate state. 

52-54. (Canceled) 



55. (New) At least one storage medium storing one or more computer programs, the 
one or more computer progriuris iricliiding instructions that, when executed, perfprni operations, 
comprising: 
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inspecting a payload portion of an electronic inail message being, communi cated and 
identifying characteristics of the payload portion, the electroriic mail message including an 
address of a recipient; 

comparing the characteristics of tiie inspected payload portion of the electronic mail 
message with stored data indicating characteristics of at least one other electronic mail message 
that has been inspected; 

based on eorriparison resultjs/ideritiJ^ for the electroriic mail 

message from among at least one pf acceptable, unacceptable, and indeterminate states; and 
processing the electronic mail message based on the first security condition, wherein 
processing the electronic mail message includes: 

rejecting the electronic mail message if the first security condition associated with 
the electronic mail message reflects the unacceptable state; 

accepting the electronic mail message if the first security condition associated 
with the electronic mail message reflects thQ> acceptable state; and 

if the first security eondilion associated with tile electronic niail message reflects 
the indeterminate state, monitoring the electronic mail message by: 

transmiitting the Qlectronic mail message based on the address of the 
electronic mail message; 

tracking a location of the transmitted electronic mail message; 
inspecting at least one other electronic mail message subsequent to 
transmitting the electronic mail message; 

updating the stored data to indicate characteristics of the at least one other 
electronic mail message that has been inspected; 

recategprizing the first security condition of the transmitted electronic 
mail message to a second security condition of the transmittpd elpctronic mail 
message based on the updated stored data; and 

reprocessing the transmitted electronic mail message based on the second 
security condition, wherein reproeessing the transmitted electronic mail message 
includes deleting the transmitted electronic mail message if the second security 
condition reflects the unacceptable state. 
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56. (New) An electronic system comprising: 

at least one storage elernent configured to store data indicatingxharacteristics of 
electronic mail messages; and 

at least one processor configured to execute instructions, stored on the at least one storage 
element, to perform operations comprising: 

inspecting a payload portion of an electronic mail message being communicated 
and identifying characteristics of the payload j)6rtion, the elecfronie mail message^ 
including an address of a recipient; 

comparing the characteristics of the inspected payload jportion of the electronic 
mail message with stored data indicating characteristics of at least one other electronic 
mail message that has been inspected; 

based on comparison results, identifying a first security condition for the: 
electronic mail message from among at least one of acceptable, unacceptable, and 
indetertninate states; and 

processing the eleGtroriiG mail meissage based on the first, security condition, 
wherein processing the electronic mail message includes: 

rejecting the electronic mail message if the first security condition 
associated with the electronic mail message reflects the unacceptable state; 

accepting the electronic mail message if the first security conditipn 
asisociated with the eleictronic mail message reflects the acceptable state; and 

if the first security condition associated with the electronic mail message 
reflects the indeterminate state, monitoring the electronic mail message by: 

transmitting the electfbhic inail message based on the address of 
the electronic mail message; 

tracking a location of the transmitted electronic mail message; 
inspecting at least one other electronic mail message subsequent to 
transmitting the electronic mail message; 

updating the stored data to indicate characteristics of the at least 
one other electronic mail message that has been inspected; 
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recategorizing the first securi ty condition of the traiasmitted 
electronic mail message to a second security condition of the transmitted 
electronic mail message based on the updated stored data; and 

reprocessing the transmitted eleclroriic mail message based on the 
second security condition, wherein reprocessing the transmitted electronic 
mail message includes dclietiiig the transmitted eleclronic mail fnessage if 
the second security condition reflects the unacceptable state. 

57. (New) An electronic System comprising: 

means for inspecting a payload portion of an electronic mail message being 
communicated and identifyiiig characteristics pf the;paylpad portion, the electron ic; mail message 
including an address of a recipient; 

means for cojnparing the characteristics of the inspected paylpad portion of the electronic 
mail message with stored data indicating characteristics of at least one other electronic mail 
message that has been inspected; 

means for, based on comparison rcsiilts, identifying a first seciirity condition for the 
electronic mml message from among at leas tone of acceptable, unacceptable, and indeterminate 
states; and 

means for processing the electronic mail message based on the first security condition, 
wherein the means for processing the electronic mail message includes: 

means for rejecting the electronic mail rhessage if the first security condition 
associated with the; electronic mail mcssagcTeflocts the unacceptable state; 

means for accepting ftie eiec&onic maii meissage i f the first security condition 
associated with the electronic mail message reflects fhc acceptable state; and 

means for, Jf the first security condition associated with the electronic mail 
message reflects the indetemTinate state, monitoring the electronic mail message by: 
transmitting the electronic mail message based on the address of the 
electronic mail message; 

tracking a location of the triansmi tted electronic mail message; 
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inspeetihg at least one other electronic mail message subsequent to 
transmitting the electronic mail message; 

updating the stored data to indicate characteristics; of the at least one other 
electronic mail message that has been inspected; 

recategorizing the first seciitity condi tion of the transmitted electronic 
mail message to a second security condition of the transmitted electronic: mail 
message based on the updated stored data; and 

reprocessing the transmitted electronic mail message based on the second 
security condition, wherein reprocessing the transmitted electroriic mail message 
includes deleting the transmitted electrbnic mail message if the second security 
condition reflects the unacceptable state. 



